American University is a student-centered research institution
located in Washington, DC, with highly-ranked schools and colleges,
internationally-renowned faculty, and a reputation for creating
meaningful change in the world. Learn more about
American University
Department:
Information Security
Time Type:
Full time
Job Type:
Regular
FLSA Status:
Exempt
Work Modality:
Hybrid 04 (On Campus 1 day/Month)
Union:
SEIU Local 500 - Provost & Enrollment Division
This position is part of a collective bargaining unit represented
by SEIU Local 500 - Provost & Enrollment Division. That means
the terms and conditions of your employment are governed by
university policy (including the Staff Personnel Policies Manual)
and any collective bargaining agreement entered into between
American University and SEIU Local 500 - Provost & Enrollment
Division.
Job Description:
Summary:
The Information Security Architect serves as the university’s
senior technical security architect and a key advisor on enterprise
security strategy, architecture, and engineering. Reporting to the
Chief Information Security Officer, this role leads the design and
integration of security controls across a complex technology
environment, including cloud platforms, infrastructure, identity,
applications, and research computing. The position partners closely
with technical and business stakeholders to ensure security is
embedded into solutions by design, aligned with institutional
priorities, risk management objectives, and regulatory
requirements. This role also drives security engineering innovation
through automation, Infrastructure as Code, DevSecOps, and platform
integration. The architect provides leadership on security reviews,
technical standards, and emerging technology assessments while
mentoring engineering staff and helping strengthen the overall
maturity of the university’s security program.
Essential Functions:
1.) Security Architecture and Technical Governance
- Develop and maintain enterprise security architectures,
reference architectures, and design patterns that integrate
security into technology solutions by design.
Lead architecture and security design reviews for
infrastructure, cloud, networking, identity, data, and application
initiatives.
Establish technical security standards and requirements for
technology procurement, implementation, and enterprise
initiatives.
Ensure security architecture aligns with university objectives,
risk tolerance, regulatory requirements, and industry best
practices.
2.) Security Engineering, Automation, and Platform Strategy
- Design and implement automation solutions using APIs,
orchestration technologies, scripting languages, and Infrastructure
as Code.
- Define engineering standards, reusable patterns, and technical
roadmaps for enterprise security platforms.
- Lead integration efforts between security and enterprise
technology platforms.
- Guide adoption of automation, DevSecOps, and Infrastructure as
Code practices across the Information Security program.
3.) Security Reviews, Risk Assessment, and Advisory Services
- Lead security assessments of university technologies, cloud
services, applications, vendors, and third-party solutions.
- Evaluate security risks associated with strategic initiatives
and recommend mitigation strategies.
- Provide technical security guidance to project teams,
architects, engineers, and university leadership.
- Participate in Enterprise Architecture activities and strategic
technology planning.
- Support compliance, audit, privacy, and regulatory initiatives
through architecture and technical review activities.
4.) Security Program Leadership and Engineering Enablement
- Mentor and provide technical guidance to Security Engineers and
Senior Security Engineers, building team capability and depth.
- Establish security engineering implementation guidance and
operational best practices.
- Support roadmap development and security program planning.
- Contribute to development of security metrics, reporting, and
maturity assessments.
5.) Research, Innovation, and Emerging Technology
- Evaluate emerging technologies, threats, and security trends,
including the security roadmaps of major enterprise platforms such
as Microsoft, Workday, Salesforce, and ServiceNow.
- Assess opportunities to improve security through automation,
AI, analytics, and engineering innovation.
- Recommend improvements to university security capabilities and
long-term technology strategy.
- Participate in professional organizations, industry working
groups, and technical communities.
Competencies:
- Serving Customers.
- Displaying Creativity.
- Prioritizing and Organizing.
- Acquiring and Analyzing Information.
- Supporting Coworkers.
Position Type/Expected Hours of Work:
- Full-time.
- 35 hours per week.
- This position works Monday through Friday with a one-hour lunch
break in a hybrid modality with one day a month required to work
from the office.
- This position participates in a published on-call rotation,
typically one week out of every four weeks, with more frequent
rotations possible during staffing shortages or unplanned absences.
- Purpose of on-call rotation: The Information Security on-call
rotation ensures timely detection, response, and coordination for
security alerts and incidents that occur outside of standard
business hours. This rotation is a critical operational
responsibility of Information Security staff and supports the
institution’s overall risk-management and incident-response
obligations.
- During an on-call rotation, the designated employee performs
their regularly work duties and must be readily available
throughout the day (including evenings, weekends, and holidays) to
proactively monitor alerts, queues and dashboards and respond to
incidents.
- Outside of on-call rotations, all team members are expected to
be reasonably available to respond to emergencies and critical or
time-sensitive security incidents.
- This role may require frequent interrupted nights and
weekends.
- The on-call designee will be required to work remotely, during
unplanned closures or weather emergencies. The rest of the team is
expected to be on call and available to work remotely to address
emergency IT issues.
- OIT staff are prohibited from taking non-emergency leave during
the three-week period at the start of each semester, this includes
the week before the start of the Fall and Spring term and the first
two weeks of classes for the Fall and Spring term. Requests for
support peak during these times and system availability is also
critical, which requires all staff members to be working during
these times.
Salary Range:
- $150,000.00 - $160,000.00 annually.
Required Education and Experience:
- Bachelor's degree or equivalent.
- 8 - 10 years of experience.
Preferred Education and Experience:
- Bachelor's degree.
- Experience working in higher education or similarly complex,
decentralized organizations is preferred.
- Relevant industry certifications such as CISSP, CCSP, GIAC, AWS
Security Specialty, Azure Security Engineer Associate, Terraform
Associate, or equivalent certifications are preferred.
Additional Eligibility Qualifications:
- Bachelor's degree in Computer Science, Cybersecurity,
Information Technology, Engineering, or a related field, or an
equivalent combination of education and experience.
- 8 - 10 years of experience in cybersecurity, systems
engineering, cloud engineering, DevSecOps, infrastructure
engineering, or related disciplines.
- Demonstrated experience designing, implementing, and
maintaining enterprise security architectures in complex
organizations.
- Extensive experience with AWS, Azure, or Google Cloud
Platform.
- Experience with Infrastructure as Code and automation
technologies, including Terraform, OpenTofu, CloudFormation, Bicep,
Ansible, Git, CI/CD platforms, and scripting languages such as
Python, PowerShell, or Bash.
- Experience integrating enterprise platforms through APIs,
automation frameworks, orchestration tools, and workflow
development.
- Experience with security operations, including detection
engineering, security automation, and Security Orchestration
Automation and Response (SOAR) platforms.
- Experience designing secure research, regulated, or
high-assurance computing environments.
- Experience with enterprise security technologies, security
engineering practices, and modern cloud-native security
controls.
- Knowledge of security standards and frameworks including NIST,
ISO 27001, FERPA, HIPAA, and higher education security
practices.
- Excellent technical, analytical, problem-solving, written and
verbal communication skills.
- Must uphold high standards of personal and professional
integrity in a position of trust.
Other Duties:
- Please note this job description is not designed to cover or
contain a comprehensive listing of activities, duties or
responsibilities that are required of the employee for this job.
Duties, responsibilities, and activities may change at any time
with or without notice.
Benefits
AU offers a competitive benefits package.
Click here to learn about American University's unique benefit
options .
Other Details
- Hiring offers for this position are contingent on successful
completion of a background check.
- Employees in staff positions at American University must
deliver their services to the university from either the District
of Columbia, Maryland, or Virginia, or perform work on-site at the
university.
- Please note this job announcement is not designed to cover or
contain a comprehensive listing of activities, duties or
responsibilities that are required of the employee for this job.
Duties, responsibilities, and activities may change at any time
with or without notice.
- American University is an
E-Verify employer.
Current American University Employees
American University current employees must apply through their
employee Workday account. If you are a current employee at American
University, please log into Workday and select the Find Jobs report
which will take you to our internal career listings.
Contact Us
For more information or assistance with the American University
careers site, email
theworkline@american.edu
.
American University is an equal opportunity, affirmative action
institution that operates in compliance with applicable laws and
regulations. The university does not discriminate on the basis of
race, color, national origin, religion, sex (including pregnancy),
age, sexual orientation, disability, marital status, personal
appearance, gender identity and expression, family
responsibilities, political affiliation, source of income, veteran
status, an individual’s genetic information or any other bases
under federal or local laws (collectively "Protected Bases") in its
programs and activities.
